Supply chain attack through GitHub Actions
theregister.com